feat(evidence): add file upload/download API endpoints with tests

- POST /uploads: multipart upload with content-type/size validation, per-session limits, S3 storage
- GET /uploads/{id}/url: presigned download URL with account ownership check
- GET /uploads: list uploads for a session
- DELETE /uploads/{id}: delete with ownership enforcement (403 for non-owners)
- Returns 503 gracefully when STORAGE_ENDPOINT is not configured
- 15 integration tests covering auth, validation, 503 behavior, and ownership

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/schemas/upload.py

@@ -0,0 +1,15 @@
+"""Schemas for file upload endpoints."""
+from datetime import datetime
+from uuid import UUID
+from pydantic import BaseModel
+
+
+class FileUploadResponse(BaseModel):
+    id: UUID
+    filename: str
+    content_type: str
+    size_bytes: int
+    url: str
+    created_at: datetime
+
+    model_config = {"from_attributes": True}